Fast, reliable and secure solutions purpose built for research and education
Solutions for managing data and enabling collaboration virtually anywhere
Solutions for protecting campus networks and assets from cyber threats
Empower collaboration, discovery and innovation
Accelerate digital transformation
Inspire great teaching and learning
Transform the classroom experience
Discover, share and preserve collections
About our company and what we do
From pioneering the internet in Australia in 1989 to today
Our Board, Executive Team and Advisory Committee
Our company policies, statements and public reports
Explore opportunities and benefits of working with AARNet
Log in to view details about your AARNet services, including usage reports
Log in to send files of any size, quickly and securely
CloudStor is being decommissioned on 15 December, 2023.
Browse answers to frequently asked questions about our products and services
Check the current performance status for our services
Fast local access to popular international open-source content
Check to see if a web address is on-net
With an increasing number of universities around the world reporting ransomware attacks and the threat showing no signs of going away, clear policies on cybersecurity and training for staff are the best form of defence for the Australian research and education community.
In a previous post, we provided information on how to protect your university from ransomware attacks. Here, we offer some advice on what to do if the worst happens and your university is attacked.
By Louise Schuster, AARNet’s Director, Cyber Security
A UK survey recently found that the majority of UK businesses hit by ransomware take a week or more to recover and suffer thousands of pounds damage a day. For 15% of those hit, the data encrypted by ransomware was not recoverable. In short, the impact of a ransomware attack on business operations can be significant.
Here are some steps you can take when faced with a ransomware attack:
If you can’t identify the ransomware, then there’s a chance it could be fake. In such cases, your files will not be encrypted; the attacker simply pops up a message which locks your screen. The ransom demand typically shows up inside a browser window and doesn’t let the user navigate away, or it locks the screen and displays a dialog box asking for an encryption key.
Having a clearly documented and agreed upon incident response plan that outlines in detail what steps the organisation will take to respond to a ransomware compromise (covering detection, containment, eradication and recovery) is critical for timely and effective remediation. The plan should be ‘tuned’ for your organisation and regularly tested to ensure it will work effectively.
In the absence of this plan, we recommend the following course of action, documenting the steps throughout this process.
Note: Cyber-insurance may provide some cover for costs incurred by ransomware infections. Ensure you understand the specific terms of your policy.
We would like to acknowledge Nick Ellsmore from Hivint for assisting with developing this advice.
Useful websites for more information: